soc

CVE-2026-38526 in Krayin CRM Enables RCE CVE-2026-38526 is a critical authenticated remote code execution (RCE) vulnerability affecting Webkul Krayin CRM / Krayin Laravel CRM v2.2.x. The issue is in the admin-side TinyMCE media upload feature and allows a logged-in user to upload a server-executable file, such as PHP, and then execute it via a normal […]

Maritime OSINT: Tracking Dark Ships & Shadow Fleets Every day, thousands of oil tankers move through the world’s oceans. Most of them broadcast their position, their name, and their destination to anyone who wants to look. But some of them don’t. The ones that go quiet, like the Dark Ships, are the most interesting ones […]

Vercel Breach: Hacker Claims to Sell Stolen Data in Potential Global Supply Chain Attack On April 19, 2026, Vercel, the cloud development platform behind Next.js and Turbopack, disclosed a security incident following a threat actor’s public claim to be selling stolen corporate data on the Dark Web. Vercel’s subsequent investigation traced the breach back to […]

Vercel and Binance Data Claims, Israel Facebook Leak, FALKONc2 Sale, and Gmail Caller Recruitment SOCRadar Dark Web Team identified several new underground posts, including an alleged Vercel access key and source code sale framed as a supply chain risk, and a separate listing claiming a 1.5 million record Binance dataset. Other posts promoted an alleged […]

Public Elasticsearch Servers Expose 9.8 Billion Credential Records Across Enterprise, Cloud, and AI Platforms Misconfigured Elasticsearch servers continue to expose massive volumes of sensitive data. This time, SOCRadar’s AI-powered Sensitive Data Exposure Monitoring service identified three publicly accessible Elasticsearch instances containing more than 9.8 billion credential records spread across separate datasets. The exposed data included […]

Nmap Commands Guide: Cheat Sheet & Reference Nmap (Network Mapper) is a free, OSINT tool used to discover devices and services on a network. Security professionals, system administrators, and ethical hackers use it daily to map networks, find open ports, detect operating systems, and run scripted checks against targets. 1. What is Nmap and What […]

Iran War Cyber Threat Outlook: Conflict Phases and What Comes Next Since the Iran War began on February 28, 2026, the conflict has moved through phases that most threat frameworks were not built to track. In cyberspace, SOCRadar tracked 1,357 incidents prominent in the first month that spanned 25+ countries, 15+ sectors, and 40+ distinct […]

BlueHammer, RedSun, and UnDefend: Three Windows Defender Zero-Days Exploited in the Wild Three Windows Defender vulnerabilities disclosed as zero-days in April 2026 are now being actively exploited: BlueHammer, RedSun, and UnDefend. All three vulnerabilities were published without patches as Proof-of-Concept (PoC) exploits by an anonymous security researcher protesting their treatment by Microsoft’s Security Response Center. […]

Phishing remains one of the most effective tactics in the cybercriminal playbook, particularly when attackers exploit urgent humanitarian themes, trusted online resources, and legitimate system tools to increase victim engagement. Europol also notes that phishing continues to serve as a primary delivery vector for data-stealing malware. This pattern is clearly reflected in the latest activity […]

Void Stealer: The Infostealer Malware Quietly Targeting Organizations in 2026 Void Stealer is an infostealer malware that emerged in late 2025 and has been running active campaigns against users and organizations ever since. Distributed under a Malware-as-a-Service (MaaS) model through Telegram channels and underground forums, it allows any operator to deploy credential-stealing campaigns for a […]